deploy.yaml

# deploy.yaml
# Copyright (c) 2025 Affinity7 Consulting Ltd
# Version: v2 (reusable, minimal auth precedence)
# SPDX-License-Identifier: MIT

on:
  workflow_call:
    inputs:
      runner:
        required: true
        type: string
      target:
        description: >
          The environment to deploy to (e.g., `dev`, `qa`, `prod`).

          - If the environment maps to a **single cluster** in `env_map`, this is all you need.
          - If the environment maps to **multiple clusters**, you must also set `target_cluster`.
        required: true
        default: "dev"

      # REQUIRED when env has >1 clusters
      target_cluster:
        description: >
          The specific cluster to deploy to when the selected `target` environment
          has more than one cluster in `env_map`.

          - For single-cluster environments (like `dev`, `qa`), leave this empty.
          - For multi-cluster environments (like `prod` with both `aks-prod-weu` and `aks-prod-use`),
            you must provide one of the valid cluster names from `env_map`.

          Example: `aks-prod-weu`   
        required: false
        default: ""
      ref:
        description: "The github ref to use for checking out files"
        required: false
        type: string
        default: ${{ github.ref || github.sha }}
      delete_first:
        description: "Delete the namespaced app first before deploying it."
        required: false
        type: boolean        
      cd_repo:
        required: true
        type: string
      github_environment:
        required: true
        type: string
      # Mode A (single app)
      application:
        required: false
        type: string
      deploy_path:
        description: "The repo path to the deployment files"
        required: false
        type: string
        default: Deployments
      image_tag:
        required: false
        type: string
      image_base_name:
        required: false
        type: string
      image_base_names:
        required: false
        type: string
      overlay_dir:
        required: false
        type: string
        default: ""

      # Mode B (multi app)
      application_details:
        description: >-
          JSON array where each item maps:
          { "name" => application, "images" => image_base_names[], "path" => deploy_path }
          Example:
          [
            {"name":"app1","images":["repo/app1","repo/sidecar"],"path":"services/app1/overlays/prod"},
            {"name":"app2","images":["repo/app2"],"path":"apps/app2/overlays/prod"}
          ]
        required: false
        type: string
        default: ''

      # Environment map (single supported shape)
      env_map:
        description: >-
          ONLY this JSON shape is supported:
          {
            "<env>": {
              "cluster_count": N,
              "clusters": [
                { "cluster": "...", "dns_zone": "...", "container_registry": "...", "uami_map": [...] }
              ]
            }
          }
        required: false
        type: string

      # Argo / misc
      argocd_auth_token:
        required: false
        type: string
      argocd_username:
        required: false
        type: string
      argocd_password:
        required: false
        type: string
      kustomize_version:
        required: false
        type: string
        default: "5.0.1"
      skip_status_check:
        required: false
        default: 'false'
        type: string
      insecure_argo:
        required: false
        default: false
        type: boolean
      convert_jinja:
        required: false
        type: boolean
        default: false
      debug:
        required: false
        type: boolean
        default: false
    secrets:
      CONTINUOUS_DEPLOYMENT_GH_APP_ID:
        required: true
      CONTINUOUS_DEPLOYMENT_GH_APP_PRIVATE_KEY:
        required: true
      ARGOCD_CA_CERT:
        required: false
      ARGOCD_USERNAME:
        required: false
      ARGOCD_PASSWORD:
        required: false

jobs:
  deploy:
    runs-on: ${{ inputs.runner }}
    environment: ${{ github_environment }}
    outputs:
      cd_path: ${{ steps.cdroot.outputs.cd_root }}
    steps:
    - name: Checkout repo
      uses: actions/checkout@v4
      with:
        repository: ${{ github.repository }}
        path: source
        ref: ${{ inputs.ref }}
        sparce-checkout: ${{ inputs.deploy_path }}

    - name: Ensure envsubst installed
      shell: bash
      run: |
        set -e
        if ! command -v envsubst >/dev/null 2>&1; then
          sudo apt-get update
          sudo apt-get install -y gettext
        fi

    - name: Generate GitHub App token
      id: generate_token
      uses: tibdex/github-app-token@v1
      with:
        app_id: ${{ secrets.CONTINUOUS_DEPLOYMENT_GH_APP_ID }}
        private_key: ${{ secrets.CONTINUOUS_DEPLOYMENT_GH_APP_PRIVATE_KEY }}
        repository: ${{ inputs.cd_repo }}

    - name: Checkout reusable workflow repo
      uses: actions/checkout@v4
      with:
        repository: gitopsmanager/k8s-deploy
        path: reusable

    - name: Checkout continuous-deployment repo
      uses: actions/checkout@v4
      with:
        repository: ${{ inputs.cd_repo }}
        token: ${{ steps.generate_token.outputs.token }}
        path: cd

    - name: Detect cloud
      id: cloud
      uses: gitopsmanager/detect-cloud@main
      with:
        timeout-ms: 800

    - name: Report cloud provider
      run: echo "☁️ Cloud provider detected: '${{ steps.cloud.outputs.provider }}'"

    - name: Warn if GitHub-hosted (unknown cloud)
      if: ${{ steps.cloud.outputs.provider == 'unknown' }}
      run: |
        echo "⚠️ Running on a GitHub-hosted runner."
        echo "Workload Identity mappings for AWS/Azure self-hosted runners will not apply."

    # Strict env_map parsing + cluster selection (with ENV_MAP fallback)
    - name: Load environment config (JSON)
      id: env
      uses: actions/github-script@v7
      env:
        INLINE_ENV_MAP: ${{ inputs.env_map }}   # workflow input (preferred)
        ENV_MAP: ${{ env.ENV_MAP }}             # fallback env var (e.g., injected from ConfigMap on self-hosted)
        ENVIRONMENT: ${{ inputs.target }}
        CLUSTER_IN: ${{ inputs.target_cluster }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const sourceInput = (process.env.INLINE_ENV_MAP || '').trim();
          const sourceEnv   = (process.env.ENV_MAP || '').trim();
          const raw = sourceInput || sourceEnv;

          if (!raw) {
            core.setFailed('❌ No env_map provided. Pass inputs.env_map OR set ENV_MAP environment variable.');
            return;
          }
          core.info(`Using env_map from ${sourceInput ? 'workflow input (inputs.env_map)' : 'ENV_MAP environment variable'}.`);

          let map;
          try { map = JSON.parse(raw); }
          catch (err) { core.setFailed(`❌ env_map is not valid JSON: ${err.message}`); return; }

          const envName   = process.env.ENVIRONMENT;
          const clusterIn = (process.env.CLUSTER_IN || '').trim();

          if (!Object.prototype.hasOwnProperty.call(map, envName)) {
            core.setFailed(`❌ Environment '${envName}' not found. Available: ${Object.keys(map).join(', ')}`);
            return;
          }

          let selected;
          if (clusterIn) {
            // Search ALL clusters across all environments
            const allClusters = Object.entries(map)
              .flatMap(([env, val]) => (val.clusters || []).map(c => ({ ...c, __env: env })));

            selected = allClusters.find(c => String(c.cluster).toLowerCase() === clusterIn.toLowerCase());
            if (!selected) {
              const available = allClusters.map(c => `${c.cluster} (env=${c.__env})`);
              core.setFailed(`❌ target_cluster '${clusterIn}' not found. Available: ${available.join(', ')}`);
              return;
            }
            core.info(`Cluster override: using cluster '${selected.cluster}' from env '${selected.__env}'`);
          } else {
            // Fallback: normal target-based selection
            const entry = map[envName];
            if (!entry || typeof entry !== 'object' || !Array.isArray(entry.clusters)) {
              core.setFailed(`❌ env_map['${envName}'] must be { cluster_count, clusters: [...] }`);
              return;
            }
            if (entry.clusters.length === 0) {
              core.setFailed(`❌ env_map['${envName}'].clusters is empty`);
              return;
            }

            if (entry.clusters.length > 1) {
              const names = entry.clusters.map(c => c.cluster).filter(Boolean);
              core.setFailed(`❌ '${envName}' has multiple clusters. Provide target_cluster. Options: ${names.join(', ')}`);
              return;
            }

            selected = entry.clusters[0];
            core.info(`Selected single cluster '${selected.cluster}' from env '${envName}'`);
          }

          const cluster   = String(selected.cluster);
          const dnsZone   = String(selected.dns_zone || '');
          const registry  = String(selected.container_registry || '');
          const uami      = Array.isArray(selected.uami_map) ? selected.uami_map : [];

          if (!cluster) { core.setFailed('❌ Selected cluster name is empty'); return; }
          if (!dnsZone) { core.setFailed(`❌ Cluster '${cluster}' is missing dns_zone`); return; }

          core.setOutput('cluster', cluster);
          core.setOutput('dns_zone', dnsZone);
          core.setOutput('container_registry', registry);
          core.setOutput('uami_map', JSON.stringify(uami));
          core.setOutput('namespace', process.env.NAMESPACE);


    - name: Export CD_ROOT
      id: cdroot
      run: |
        CD_ROOT="continuous-deployment/${{ steps.env.outputs.cluster }}/${{ inputs.namespace }}"
        echo "CD_ROOT=$CD_ROOT" >> "$GITHUB_ENV"
        echo "cd_root=$CD_ROOT" >> "$GITHUB_OUTPUT"

    # Export UAMI env vars (uami_name => client_id)
    - name: Export UAMI env vars (uami_name => client_id)
      uses: actions/github-script@v7
      env:
        UAMI_JSON: ${{ steps.env.outputs.uami_map }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
      with:
        script: |
          const fs = require('fs');
          const clusterName = (process.env.CLUSTER || '').trim();

          let arr = [];
          try { arr = JSON.parse(process.env.UAMI_JSON || '[]'); }
          catch { core.setFailed('❌ Selected cluster uami_map is not valid JSON'); return; }

          if (!Array.isArray(arr) || arr.length === 0) {
            core.info('No UAMI entries for selected cluster.');
            return;
          }

          const seen = new Set();
          const exported = [];

          for (const [i, u] of arr.entries()) {
            let name = String(u.uami_name || '').trim();
            const rg   = String(u.uami_resource_group || '').trim();
            const cid  = String(u.client_id || '').trim();

            if (!name || !cid) {
              core.warning(`Skipping UAMI index ${i}: missing uami_name or client_id.`);
              continue;
            }

            // Remove "<clusterName>-" prefix if present
            const prefix = clusterName + "-";
            if (name.toLowerCase().startsWith(prefix.toLowerCase())) {
              name = name.substring(prefix.length);
            }

            // Replace '-' with '_'
            let varName = name.replace(/-/g, "_");

            // Ensure valid shell identifier
            if (!/^[A-Za-z_]/.test(varName)) varName = `_${varName}`;

            if (seen.has(varName)) {
              core.warning(`Duplicate UAMI var '${varName}' (rg='${rg}'). Skipping duplicate.`);
              continue;
            }

            fs.appendFileSync(process.env.GITHUB_ENV, `${varName}=${cid}\n`);
            seen.add(varName);
            exported.push({ varName, cid });
          }

          if (exported.length === 0) {
            core.info("No UAMI vars exported.");
          } else {
            core.info("Exported UAMI vars for templating:");
            for (const e of exported) {
              core.info(`  ${e.varName}=${e.cid}`);
            }
          }




    # Unify to a single apps[] list for either mode
    - name: Resolve apps (single or multi)
      id: apps
      uses: actions/github-script@v7
      env:
        APP_DETAILS: ${{ inputs.application_details }}
        APPLICATION: ${{ inputs.application }}
        DEPLOY_PATH: ${{ inputs.deploy_path }}
        IMG_ONE: ${{ inputs.image_base_name }}
        IMG_LIST: ${{ inputs.image_base_names }}
      with:
        script: |
          const detailsRaw = (process.env.APP_DETAILS || '').trim();
          let apps = [];
          if (detailsRaw) {
            let arr;
            try { arr = JSON.parse(detailsRaw); }
            catch(e){ core.setFailed(`❌ application_details is not valid JSON: ${e.message}`); return; }
            if (!Array.isArray(arr)) { core.setFailed('❌ application_details must be a JSON array'); return; }
            for (let i=0;i<arr.length;i++){
              const it = arr[i] || {};
              const name = String(it.name || '').trim();
              const path = String(it.path || '').trim();
              const images = Array.isArray(it.images) ? it.images.map(String) : [];
              if (!name) { core.setFailed(`❌ application_details[${i}].name is required`); return; }
              if (!path) { core.setFailed(`❌ application_details[${i}].path is required`); return; }
              apps.push({ name, path, images });
            }
          } else {
            // Single app mode
            const name = (process.env.APPLICATION || '').trim();
            const path = (process.env.DEPLOY_PATH || '').trim();
            const images = [];
            if ((process.env.IMG_ONE || '').trim()) images.push(process.env.IMG_ONE.trim());
            if ((process.env.IMG_LIST || '').trim()) {
              for (const s of process.env.IMG_LIST.split(',').map(x => x.trim()).filter(Boolean)) images.push(s);
            }
            if (!name) { core.setFailed('❌ application is required when application_details is not provided'); return; }
            if (!path) { core.setFailed('❌ deploy_path is required when application_details is not provided'); return; }
            apps.push({ name, path, images });
          }
          core.setOutput('apps', JSON.stringify(apps));
          core.setOutput('count', String(apps.length));

    # Optional Jinja → envsubst conversion (per app paths)
    - name: Convert Jinja2 {{ var }} to envsubst ${var} (skip Jinja control files)
      if: ${{ inputs.convert_jinja }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const src = `source/${app.path}`;
            execSync(`bash -lc 'if [ -d "${src}" ]; then \
              find "${src}" \\( -name "*.yaml" -o -name "*.yml" -o -name "*.json" \\) -type f -print0 | \
              while IFS= read -r -d "" f; do \
                if ! grep -q "{%" "$f"; then sed -E -i "s/\\{\\{\\s*([A-Za-z_][A-Za-z0-9_]*)\\s*\\}\\}/\\$\\{\\1\\}/g" "$f"; fi; \
              done; fi'`, { stdio: 'inherit' });
          }

    - name: Template manifest files with envsubst (per app)
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CLUSTER_NAME: ${{ steps.env.outputs.cluster }}
        DNS_ZONE: ${{ steps.env.outputs.dns_zone }}
        NAMESPACE: ${{ inputs.namespace }}
        APPLICATION_DEFAULT: ${{ inputs.application }}
        CONTAINER_REGISTRY: ${{ steps.env.outputs.container_registry }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const src = `source/${app.path}`;
            // APPLICATION env for templating: prefer per-app name
            execSync(`bash -lc 'export CLUSTER_NAME="${process.env.CLUSTER_NAME}"; \
              export DNS_ZONE="${process.env.DNS_ZONE}"; \
              export NAMESPACE="${process.env.NAMESPACE}"; \
              export APPLICATION="${app.name}"; \
              export CONTAINER_REGISTRY="${process.env.CONTAINER_REGISTRY}"; \
              if [ -d "${src}" ]; then \
                find "${src}" \\( -name "*.yaml" -o -name "*.yml" -o -name "*.json" \\) -type f -print0 | \
                while IFS= read -r -d "" f; do \
                  if grep -q "\\${" "$f"; then envsubst < "$f" > "$f.tmp" && mv "$f.tmp" "$f"; fi; \
                done; \
              fi'`, { stdio: 'inherit' });
          }

    - name: Copy templated files to CD repo (per app)
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_ROOT: ${{ env.CD_ROOT }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const src = `source/${app.path}`;
            const dst = `cd/${process.env.CD_ROOT}/${app.name}/${app.path}`;
            execSync(`bash -lc 'mkdir -p "${dst}"; rm -rf "${dst}"/* || true; cp -r "${src}/." "${dst}/"'`, { stdio: 'inherit' });
          }

    - name: Debug structure
      if: ${{ inputs.debug }}
      run: find "cd/${{ env.CD_ROOT }}" || echo "Nothing copied!"

    - name: Setup Kustomize
      uses: imranismail/setup-kustomize@v2
      with:
        kustomize-version: ${{ inputs.kustomize_version }}

    - name: Patch image tag(s) (per app)
      if: ${{ inputs.image_tag != '' }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_ROOT: ${{ env.CD_ROOT }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
        IMAGE_TAG: ${{ inputs.image_tag }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          const overlayDir = (process.env.OVERLAY_DIR || '').trim();
          for (const app of apps) {
            const base = overlayDir ? `cd/${process.env.CD_ROOT}/${app.name}/${app.path}/overlays/${overlayDir}` : `cd/${process.env.CD_ROOT}/${app.name}/${app.path}`;
            if ((app.images || []).length === 0) continue;
            for (const img of app.images) {
              execSync(`bash -lc 'cd "${base}" && kustomize edit set image "${img}=*:${process.env.IMAGE_TAG}"'`, { stdio: 'inherit' });
            }
          }

    - name: Run kustomize build (concat per app)
      id: kustomize
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_ROOT: ${{ env.CD_ROOT }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
      with:
        script: |
          const { execSync } = require('child_process');
          const fs = require('fs');
          const apps = JSON.parse(process.env.APPS || '[]');
          const overlayDir = (process.env.OVERLAY_DIR || '').trim();
          const outFile = `${process.env.GITHUB_WORKSPACE}/build-output.yaml`;
          fs.writeFileSync(outFile, '');
          let first = true;
          for (const app of apps) {
            const dir = overlayDir ? `cd/${process.env.CD_ROOT}/${app.name}/${app.path}/overlays/${overlayDir}` : `cd/${process.env.CD_ROOT}/${app.name}/${app.path}`;
            const yaml = execSync(`bash -lc 'cd "${dir}" && kustomize build .'`, { encoding: 'utf8' });
            fs.appendFileSync(outFile, (first ? '' : '\n---\n') + yaml);
            first = false;
          }

    - name: Upload built manifest as artifact
      uses: actions/upload-artifact@v4
      with:
        name: built-kustomize-manifest
        path: build-output.yaml

    - name: Upload templated source manifests as artifact
      uses: actions/upload-artifact@v4
      with:
        name: templated-source-manifests
        path: source

    - name: Commit and push to continuous-deployment repo
      run: |
        cd cd
        git config user.name "GitHub Actions"
        git config user.email "actions@github.com"
        git add "${{ env.CD_ROOT }}/"
        git diff --cached --quiet && exit 0
        git commit -m "Deploy to ${{ steps.env.outputs.cluster }}/${{ inputs.namespace }} (apps: ${{ steps.apps.outputs.count }})"
        git push

    - name: Resolve ArgoCD auth
      id: resolve_auth
      env:
        IN_TOKEN: ${{ inputs.argocd_auth_token }}
        IN_USER: ${{ inputs.argocd_username }}
        IN_PASS: ${{ inputs.argocd_password }}
        SEC_USER: ${{ secrets.ARGOCD_USERNAME }}
        SEC_PASS: ${{ secrets.ARGOCD_PASSWORD }}
      run: |
        set -euo pipefail
        if [ -n "${IN_TOKEN:-}" ]; then
          echo "mode=token" >> "$GITHUB_OUTPUT"
          echo "token=$IN_TOKEN" >> "$GITHUB_OUTPUT"
        elif [ -n "${IN_USER:-}" ] && [ -n "${IN_PASS:-}" ]; then
          echo "mode=basic" >> "$GITHUB_OUTPUT"
          echo "username=$IN_USER" >> "$GITHUB_OUTPUT"
          echo "password=$IN_PASS" >> "$GITHUB_OUTPUT"
        elif [ -n "${SEC_USER:-}" ] && [ -n "${SEC_PASS:-}" ]; then
          echo "mode=basic" >> "$GITHUB_OUTPUT"
          echo "username=$SEC_USER" >> "$GITHUB_OUTPUT"
          echo "password=$SEC_PASS" >> "$GITHUB_OUTPUT"
        else
          echo "❌ No ArgoCD auth provided."
          exit 1
        fi

    - name: Set ArgoCD connection (token & URLs)
      id: argocd_conn
      uses: actions/github-script@v7
      env:
        MODE: ${{ steps.resolve_auth.outputs.mode }}
        TOKEN: ${{ steps.resolve_auth.outputs.token }}
        USERNAME: ${{ steps.resolve_auth.outputs.username }}
        PASSWORD: ${{ steps.resolve_auth.outputs.password }}
        ARGOCD_CA_CERT: ${{ secrets.ARGOCD_CA_CERT }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
        DNS_ZONE: ${{ steps.env.outputs.dns_zone }}
        INSECURE_ARGO: ${{ inputs.insecure_argo }}
      with:
        script: |
          const { execSync } = require('child_process');
          const fs = require('fs');
          const cluster = process.env.CLUSTER;
          const dnsZone = process.env.DNS_ZONE;
          const argocdUrl = `https://${cluster}-argocd-argocd-web-ui.${dnsZone}`;
          let curlSslFlags = "";
          if (String(process.env.INSECURE_ARGO) === "true") curlSslFlags = "-k";
          else if (process.env.ARGOCD_CA_CERT) { fs.writeFileSync('/tmp/argocd-ca.crt', process.env.ARGOCD_CA_CERT); curlSslFlags = "--cacert /tmp/argocd-ca.crt"; }

          let finalToken = process.env.TOKEN;
          if (process.env.MODE !== "token") {
            const body = JSON.stringify({ username: process.env.USERNAME, password: process.env.PASSWORD });
            const resp = execSync(`curl -s ${curlSslFlags} -X POST "${argocdUrl}/api/v1/session" -H "Content-Type: application/json" -d '${body.replace(/'/g,"'\\''")}'`).toString();
            try { finalToken = JSON.parse(resp).token; } catch { core.setFailed("❌ Failed to parse ArgoCD session response"); return; }
          }
          if (!finalToken) { core.setFailed("❌ Failed to obtain ArgoCD token."); return; }

          core.setOutput('argocd_url', argocdUrl);
          core.setOutput('curl_ssl_flags', curlSslFlags);
          core.setOutput('token', finalToken);


    - name: Delete ArgoCD apps first (per app)
      if: ${{ inputs.delete_first }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');

          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const deleteUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;

            try {
              const http = execSync(
                `bash -lc 'curl ${process.env.CURL_SSL_FLAGS} -s -o /dev/null -w "%{http_code}" -X DELETE "${deleteUrl}" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}"'`,
                { encoding: 'utf8' }
              ).trim();

              if (http === '200') {
                core.info(`🗑️ Deleted Argo app ${appName}`);
              } else if (http === '404') {
                core.info(`ℹ️ Argo app ${appName} not found, skipping delete.`);
              } else {
                core.warning(`⚠️ Unexpected response deleting ${appName}: HTTP ${http}`);
              }
            } catch (err) {
              core.setFailed(`❌ Failed to run delete for ${appName}: ${err.message}`);
              return;
            }
          }




    - name: Check or create ArgoCD applications (per app)
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_ROOT: ${{ env.CD_ROOT }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
        CD_REPO: ${{ inputs.cd_repo }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const statusUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;
            const cdPath = (process.env.OVERLAY_DIR || '').trim()
              ? `${process.env.CD_ROOT}/${app.name}/${app.path}/overlays/${process.env.OVERLAY_DIR}`
              : `${process.env.CD_ROOT}/${app.name}/${app.path}`;

            const http = execSync(`bash -lc 'curl ${process.env.CURL_SSL_FLAGS} -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${statusUrl}"'`, { encoding: 'utf8' }).trim();
            if (http === '200') { core.info(`✅ Argo app ${appName} exists.`); continue; }
            if (http !== '403') { core.setFailed(`❌ Unexpected ArgoCD response for ${appName}: HTTP ${http}`); return; }

            # Create app from template via envsubst
            execSync(`bash -lc 'APP_NAME="${appName}" CD_REPO="${process.env.CD_REPO}" CD_PATH="${cdPath}" NAMESPACE="${process.env.NAMESPACE}" \
              envsubst < reusable/templates/argocd-application-template.json > rendered-app.json && \
              curl ${process.env.CURL_SSL_FLAGS} -s -X POST "${process.env.ARGOCD_URL}/api/v1/applications" \
                -H "Content-Type: application/json" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" \
                --data-binary @rendered-app.json'`, { stdio: 'inherit' });
            core.info(`✅ Created Argo app ${appName}.`);
          }

    - name: Sync ArgoCD apps (per app)
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const syncUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}/sync`;
            const http = execSync(`bash -lc 'curl ${process.env.CURL_SSL_FLAGS} -s -w "%{http_code}" -o /tmp/resp.txt -X POST "${syncUrl}" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" -d "{}"'`, { encoding: 'utf8' }).trim();
            if (http !== '200' && http !== '201') {
              execSync('bash -lc "cat /tmp/resp.txt"',{stdio:'inherit'});
              core.setFailed(`❌ Failed to trigger sync for ${appName}: HTTP ${http}`); return;
            }
            core.info(`🚀 Sync triggered: ${appName}`);
          }

    - name: Wait for ArgoCD sync (per app)
      if: ${{ inputs.skip_status_check != 'true' }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const statusUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;
            let ok = false;
            for (let i=0;i<12;i++){
              const resp = execSync(`bash -lc 'curl ${process.env.CURL_SSL_FLAGS} -s -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${statusUrl}"'`, { encoding: 'utf8' });
              try {
                const json = JSON.parse(resp);
                if ((json?.status?.sync?.status || '') === 'Synced') { ok = true; break; }
              } catch {}
              execSync('bash -lc "sleep 10"');
            }
            if (!ok) { core.setFailed(`❌ ArgoCD sync did not complete in time for ${appName}`); return; }
            core.info(`✅ ArgoCD sync completed for ${appName}.`);
          }